Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Track your Microsoft Sentinel Migration with a Workbook

4 September 2026Doc update+36 / −35 lines

In brief

The guide now explains that the DeploymentandMigration watchlist stores actions used to track migration progress and that MITRE coverage maps deployed analytics rules to identify detection gaps. Wording, formatting, and SOAR references were also updated.

What Defender admins need to know

Administrators can use the clarified instructions when deploying the workbook and watchlist and reviewing detection coverage.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Track your Microsoft Sentinel migrationMigration with a workbookWorkbook description: Learn how to track your migration with a workbook, how to customize and manage the workbook, and how to use the workbook tabs for useful Microsoft Sentinel actions. author: EdB-MSFT ms.author: edbaynash ms.topic: how-to ms.date: 06/15/07/01/2026 appliesto: - Microsoft Sentinel in the Microsoft Defender portal - Microsoft Sentinel in the Azure portal ms.collection: usx-security ms.custom: sfi-image-nochange, msecd-doc-authoring-10141016 ai-usage: ai-assisted

  • Deploy and monitor analytics rules and incidents
  • Deploy and utilize workbooks
  • Deploy and perform automation
  • Deploy and customize user and entity behavioral analytics (U E B A)(UEBA)

This article describes how to track your migration with the Microsoft Sentinel Deployment and Migration workbook, how to customize and manage the workbook, and how to use the workbook tabs to deploy and monitor data connectors, analytics, incidents, playbooks, automation rules, U E B A,UEBA, and data management. Learn more about how to use Azure Monitor workbooks in Microsoft Sentinel.

Deploy the workbook content and view the workbook

  1. In the Microsoft Sentinel Content hub, filter the content listed by Content type = Workbooks, and then enter migration in the search bar.

  2. From the search results, select the Microsoft Sentinel Deployment and Migration workbook andworkbook, then select Install. Microsoft Sentinel deploys the workbook and saves the workbook in your environment.

  3. In Microsoft Sentinel, under Threat management, select Workbooks > Templates.

  4. Select the Microsoft Sentinel Deployment and Migration workbook and View template.

Deploy the watchlist

The next step isDeploymentandMigration watchlist stores the deployment and migration actions that the workbook uses to deploy the relatedtrack your progress. Deploy this watchlist from the Microsoft Sentinel GitHub repository.

  1. In the Microsoft Sentinel GitHub repository, select the DeploymentandMigration folder, and select Deploy to Azure to begin the template deployment in Azure.
  2. Provide the Microsoft Sentinel resource group and workspace name. :::image type="content" source="media/migration-track/migration-track-azure-deployment.png" alt-text="Screenshot of deploying the watchlist to Azure.":::
  3. Select Review and create.
  4. After the information is validated, select Create.

Update the watchlist with deployment and migration actions

  1. In the Azure or Microsoft Defender portal, select Microsoft Sentinel and then select Watchlist.
  2. Select the watchlist with the Deployment alias.
  3. Then select Update watchlist > edit watchlist items.
  4. Provide the information for the actions needed for the deployment and migration. :::image type="content" source="media/migration-track/migration-track-update-watchlist.png" alt-text="Screenshot of updating watchlist items with deployment and migration actions." lightbox="media/migration-track/migration-track-update-watchlist.png":::
  5. Select Save.

:::image type="content" source="media/migration-track/migration-track-data-connectors.png" alt-text="Screenshot of the workbook's Data Connectors tab Monitor view." lightbox="media/migration-track/migration-track-data-connectors.png":::

To configure a data connector:

  1. Select the Configure view.
  2. Select the button with the name of the connector you want to configure.
  3. Configure the connector in the connector status screen that opens. If you can't find a connector you need, select the connector name to open the connector gallery or solution gallery. :::image type="content" source="media/migration-track/migration-track-configure-data-connectors.png" alt-text="Screenshot of the workbook's Configure view.":::

Deploy and monitor analytics and incidents

:::image type="content" source="media/migration-track/migration-track-analytics.png" alt-text="Screenshot of the workbook's Analytics tab." lightbox="media/migration-track/migration-track-analytics.png":::

The MITRE coverage view maps your deployed analytics rules to the MITRE ATT&CK framework, so you can identify gaps in threat detection. If you need more coverage, select Review MITRE coverage below the table on the left. Use the Review MITRE coveragethis option to define which areas receive more coverage and which rules are deployed, at any stage of the migration project.

:::image type="content" source="media/migration-track/migration-track-mitre.png" alt-text="Screenshot of the workbook's MITRE Coverage view." lightbox="media/migration-track/migration-track-mitre.png":::

Deploy and utilize workbooks

To visualize information regarding the data ingestion and detections that Microsoft Sentinel performs, in the Microsoft Sentinel Deployment and Migration workbook, select Workbooks. Use the Monitor view for monitoring information and the Configure view for configuration information.

Here are some useful tasks to do in the Workbooks tab:

  • To view a list of all workbooks in the environment and how many workbooks are deployed, select Monitor.

  • To view a specific workbook within the Microsoft Sentinel Deployment and Migration workbook, select a workbook and then select Open Selected Workbook.

    :::image type="content" source="media/migration-track/migration-track-workbook.png" alt-text="Screenshot of selecting a workbook in the Workbook tab." lightbox="media/migration-track/migration-track-workbook.png":::

  • If you haven't yet deployed workbooks, select Configure to view a list of commonly used and recommended workbooks. If a workbook isn't listed, select Go to Workbook Gallery or Go to Content Hub to deploy the relevant workbook.

    :::image type="content" source="media/migration-track/migration-track-view-workbooks.png" alt-text="Screenshot of viewing a workbook from the Workbook tab.":::

Deploy and monitor playbooks and automation rules

When you configure data ingestion, detections, and visualizations, you can now look into automation. In the Microsoft Sentinel Deployment and Migration workbook, select Automation to view deployed playbooks, and to see which playbooks are currently connected to an automation rule. If automation rules exist, the workbook highlights the following information regarding each rule:

  • Name
  • Status
  • Action or actions of the rule

To view, deploy, and test automation in the Automation section of the workbook, select Deploy automation resources on the bottom left.

Learn about Microsoft Sentinel SOAR capabilities:capabilities for playbooks and automation rules: Automate responses with playbooks and Automate incident handling with automation rules.

:::image type="content" source="media/migration-track/migration-track-automation.png" alt-text="Screenshot of the workbook's Automation tab." lightbox="media/migration-track/migration-track-automation.png":::

Because data reporting and detections happen at the entity level, it's essential to monitor entity behavior and trends. User and entity behavior analytics (UEBA) helps you do this. To enable the UEBA feature within Microsoft Sentinel, in the Microsoft Sentinel Deployment and Migration workbook, select UEBA. Here you can customize the entity timelines for entity pages, and view which entity related tables are populated with data.

:::image type="content" source="media/migration-track/migration-track-ueba.png" alt-text="Screenshot of the workbook's U E B AUEBA tab.":::

To enable U E B A: UEBA:

  1. Select Enable UEBA above the list of tables.
  2. To enable U E B A,UEBA, select On.
  3. Select the data sources you want to use to generate insights.
  4. Select Apply.

After you enable U E B A,UEBA, monitor and ensure that Microsoft Sentinel is generating U E B AUEBA data.

To customize the timeline:

  1. Select Customize Entity Timeline above the list of tables.
  2. Create a custom item, or select one of the out-of-the-box templates.
  3. To deploy the template and complete the wizard, select Create.

Learn more about UEBA or learn how to customize the timeline.

Configure and manage the data lifecycle

  • Tables configured to be archived
  • Tables on the default workspace retention

To modify the existing retention policy for tables:

  1. Select the Default Retention Tables view.
  2. Select the table you want to modify,modify and select Update Retention. Edit the following information as needed:
    • Current retention in the workspace
    • Current retention in the archive
    • Total number of days the data lives in the environment
  3. Edit the TotalRetention value to set a new total number of days that the data should exist within the environment.

The ArchiveRetention value is calculated by subtracting the TotalRetention value from the InteractiveRetention value. If you need to adjust the workspace retention, the change doesn't impact tables that include configured archives and data isn't lost. If you edit the InteractiveRetention value and the TotalRetention value doesn't change, Azure Log Analytics adjusts the archive retention to compensate the change.

If you prefer to make changes in the UI, select Update Retention in UI to open the relevant page.

Learn about data lifecycle management.

Enable migration tips and instructions

To assist with the deployment and migration process, the workbook includes tips that explain how to use the different tabs, and links to relevant resources. The tips are based on Microsoft Sentinel migration documentation and are relevant to your current SIEM. To enable tips and instructions, in the Microsoft Sentinel Deployment and Migration workbook, on the top right, set MigrationTips and Instruction to Yes.

:::image type="content" source="media/migration-track/migration-track-tips.png" alt-text="Screenshot of the workbook's migration tips and instructions." lightbox="media/migration-track/migration-track-tips.png":::

Next stepsRelated content

In this article, you learned how to track your migration with the Microsoft Sentinel Deployment and Migration workbook.